Seiko Disables Online Wishlist Feature After Third-Party Security Incident
Seiko has temporarily removed the wishlist feature from three of its Japanese online stores after a security incident involving Swym, the third-party provider behind the Wishlist Plus service.
The decision was announced on October 30, 2026, as a precaution while Seiko investigates whether its own online stores were affected. The suspension applies to Grand Seiko Boutique Online, Seiko Online Store, and Seiko Clock Online Store. Customers visiting these sites can no longer use the favorites or wishlist function for the time being.
The issue stems from a wider security incident at Swym, whose Wishlist Plus application is used by multiple online retailers. According to Swym’s own investigation, an unauthorized party changed the application’s configuration on October 14, causing malicious code to load on certain pages of a limited number of merchant websites.
The malicious code was designed to target checkout button clicks. In affected stores, shoppers who selected a checkout button could have been redirected to a fake payment page made to look legitimate. If a customer entered card details on that fraudulent page, the information may have been exposed to attackers.
Swym said the unauthorized configuration change took place between 10:06 and 11:56 UTC on October 14. The company began deploying fixes at 15:02 UTC and completed the rollout by 16:32 UTC the same day.
In a later security update, Swym clarified that the injected script did not automatically steal information entered into genuine checkout forms. Instead, the risk applied to shoppers who were redirected away from a retailer’s real store and manually entered payment information on the fraudulent external page.
Following the incident, Swym revoked application credentials, removed the malicious script, and introduced stronger security controls. The company also temporarily suspended Wishlist Plus across all merchants, including businesses not confirmed to be directly affected, before gradually restoring the service.
Seiko says it has not confirmed any leak of personal information from its online stores. The company has also not stated whether any Seiko customers were redirected to fake checkout pages during the incident.
Swym has similarly reported no evidence that merchant accounts or customer information stored within its application were compromised. However, the provider acknowledged that customers who entered payment details on a fraudulent page outside a legitimate store may have put their information at risk.
Seiko is urging customers to remain alert for suspicious emails or text messages that claim to be related to the incident. The company warned users to be cautious of unfamiliar links, unexpected attachments, or messages requesting personal or payment information.
At this stage, Seiko has not announced when the wishlist feature will return to its Japanese online stores. The watchmaker says it will provide further updates if its ongoing investigation reveals additional details.
